Vulnerabilities / WP Sort Order / WPSEC-2026-2342
WP Sort Order <= 1.3.6 - Missing Authorization to Unauthenticated Sort Order Refresh
Medium 5.3
CWE-862Fixed in 1.3.7
- ID
- WPSEC-2026-2342
- Plugin
- WP Sort Order (wp-sort-order)
- Affected
- all versions before 1.3.7
- Remediation
- Update to 1.3.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- WP Sort Order on WPSec AttackSurface
- Fix released
- Published
Description
The WP Sort Order plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.3.6, due to a missing capability check on the refresh() function. The plugin hooks this function to admin_init whenever the 'page' parameter is set to 'wpso-settings'. This makes it possible for unauthenticated attackers to trigger the re-numbering of post menu order and term order values for the configured post types and taxonomies, and the deletion and rebuilding of the plugin's user order meta, which can reset custom user ordering.
References
- https://wpsec.com/vuln/WPSEC-2026-2342/
- https://plugins.svn.wordpress.org/wp-sort-order/tags/1.3.7/
- https://wordpress.org/plugins/wp-sort-order/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS